package com.bonc.web.xss;

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONObject;
import com.bonc.util.exception.BusinessException;
import com.bonc.util.response.CommResponseEnum;
import org.springframework.web.multipart.MultipartHttpServletRequest;
import org.springframework.web.multipart.commons.CommonsMultipartResolver;
import javax.servlet.*;
import javax.servlet.http.HttpServletRequest;
import java.io.BufferedReader;
import java.io.IOException;
import java.util.HashMap;
import java.util.Map;

/**
 * @author wxy
 */
public class XssFilter implements Filter {

    @Override
    public void destroy() {
        // TODO Auto-generated method stub

    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse resp, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) request;
        // 获得当前请求的URI
        String nowPath = req.getRequestURI();
        //若为接口,则过滤参数
        if (!nowPath.contains(".")) {
                 //判断是否为相应带文件参数的接口
                if (nowPath.endsWith("multipartApi")) {
                    CommonsMultipartResolver multipartResolver = new CommonsMultipartResolver();
                    MultipartHttpServletRequest multiReq = multipartResolver.resolveMultipart(req);
                    Map<String, String> contentTypes = new HashMap<>();
                    XssMultipartHttpServletRequestWrapper xssM = new XssMultipartHttpServletRequestWrapper(req,multiReq.getMultiFileMap(),multiReq.getParameterMap(),contentTypes);
                    chain.doFilter(xssM, resp);
                    return;
                }
                //单独处理json参数的接口,xxs漏洞预防
                if (nowPath.endsWith("JSONApi")) {
                    XssJsonHttpServletRequestWrapper xssRequest = new XssJsonHttpServletRequestWrapper((HttpServletRequest) request);
                    // 读取请求内容
                    BufferedReader br;
                    br = xssRequest.getReader();
                    String line = null;
                    StringBuilder sb = new StringBuilder();
                    while ((line = br.readLine()) != null) {
                        sb.append(line);
                    }
                    // 将json字符串转换为json对象
                    JSONObject jsonObject = JSONObject.parseObject(sb.toString());
                    SensitivewordFilter filter = new SensitivewordFilter();
                    for (Map.Entry<String, Object> entry : jsonObject.entrySet()) {
                        //判断是否包含敏感字符
                        if(filter.getSensitiveWord(entry.getValue() ==null ? "" : entry.getValue().toString(),1).size()>0){
                            throw new BusinessException(CommResponseEnum.APIERROR6);
                        }
                        // 替换危险字符
                        jsonObject.put(entry.getKey(), SequenceTool.xssEncode(entry.getValue()));
                    }
                    // 把参数转换之后放到我们的body里面
                    String json = JSON.toJSONString(jsonObject);
                    xssRequest.setBody(json.getBytes("UTF-8"));
                    // 放行
                    chain.doFilter(xssRequest, resp);
                    return;
                }
                chain.doFilter(new XssHttpServletRequestWrapper(req), resp);
                return;

        }
        chain.doFilter(req, resp);
        return;

    }

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        }

}
